vybekiit 0.7.26 → 0.7.28

package/dist/global-skills/resend/references/webhooks.md

@@ -65,6 +65,7 @@ The `email.received` payload contains metadata only (sender, recipient, subject,
 |-------|---------|
 | `domain.created` / `updated` / `deleted` | Domain configuration changes |
 | `contact.created` / `updated` / `deleted` | Contact list changes (not from CSV imports) |
+| `suppression.added` / `removed` | Email address added to or removed from the suppression list |
 
 ## Setup
 
@@ -144,6 +145,11 @@ The `signing_secret` is only returned once when you create the webhook. Store it
 | Get | `resend.webhooks.get(id)` | `resend.Webhooks.get(id)` |
 | Update | `resend.webhooks.update(id, params)` | `resend.Webhooks.update(params)` — `webhook_id` inside params |
 | Delete | `resend.webhooks.remove(id)` | `resend.Webhooks.remove(id)` |
+| Rotate Signing Secret | `resend.webhooks.rotateSigningSecret(id)` | `resend.Webhooks.rotate_signing_secret(webhook_id)` |
+| List Events | `resend.webhooks.events.list({ webhookId, ...params })` | `resend.Webhooks.list_events(webhook_id, params?)` |
+| Get Event | `resend.webhooks.events.get({ webhookId, eventId })` | `resend.Webhooks.get_event(webhook_id, event_id)` |
+| Replay Event | `resend.webhooks.events.replay({ webhookId, eventId })` | `resend.Webhooks.replay_event(webhook_id, event_id)` |
+| List Event Attempts | `resend.webhooks.events.attempts.list({ webhookId, eventId, ...params })` | `resend.Webhooks.list_event_attempts(webhook_id, event_id, params?)` |
 
 ```typescript
 // List all webhooks
@@ -160,13 +166,64 @@ const { data: updated, error: updateError } = await resend.webhooks.update(
 
 // Delete a webhook
 const { data: deleted, error: deleteError } = await resend.webhooks.remove('4dd369bc-aa82-4ff3-97de-514ae3000ee0');
+
+// Rotate the signing secret — for 24 hours payloads are signed with both secrets, then only the new one
+const { data: rotated, error: rotateError } = await resend.webhooks.rotateSigningSecret('4dd369bc-aa82-4ff3-97de-514ae3000ee0');
+// rotated: { object: 'webhook', id, signing_secret: 'whsec_...' }
+// Update RESEND_WEBHOOK_SECRET with rotated.signing_secret right away
 ```
 
 **Key gotchas:**
-- `signing_secret` is only in the create response — `get` does not return it
+- `signing_secret` is in the create, get, and rotate responses — read it back with `get`, rotate it if it leaked
 - Update can change `endpoint` and `events` — partial updates supported
 - Use `.remove()` not `.delete()` in the Node.js SDK
 
+### Delivery History (Events and Attempts)
+
+Inspect what Resend delivered to a webhook and how the endpoint responded. Use this
+to debug an endpoint that is missing events or returning errors, instead of asking
+the user to check the dashboard.
+
+```typescript
+// 1. Find the event — most recent first, forward-only pagination
+const { data: events, error } = await resend.webhooks.events.list({
+  webhookId: '4dd369bc-aa82-4ff3-97de-514ae3000ee0',
+  limit: 20,
+});
+if (error) throw error;
+// events.data[i]: { id, type, created_at, status }
+// status: 'pending' | 'attempting' | 'success' | 'failed'
+const eventId = events.data[0].id;
+
+// 2. See the exact payload Resend sent, and when the next retry is due
+const { data: event } = await resend.webhooks.events.get({
+  webhookId: '4dd369bc-aa82-4ff3-97de-514ae3000ee0',
+  eventId,
+});
+// event.next_attempt_at is null once status is 'success' or 'failed'
+// event.payload is the JSON body your endpoint received
+
+// 3. Manually replay a failed or missed event — queues one more delivery
+const { data: replayed, error: replayError } = await resend.webhooks.events.replay({
+  webhookId: '4dd369bc-aa82-4ff3-97de-514ae3000ee0',
+  eventId,
+});
+// replayed.id is the same event ID — replay does not schedule automatic retries
+
+// 4. See what your endpoint returned on each try
+const { data: attempts } = await resend.webhooks.events.attempts.list({
+  webhookId: '4dd369bc-aa82-4ff3-97de-514ae3000ee0',
+  eventId,
+});
+// attempts.data[i]: { id, http_status_code, response, sent_at }
+```
+
+Both lists take `limit` (1–100, default 20) and `after` (the last `id` of the
+previous page). There is no `before` — the API rejects it with a 422.
+
+Replay returns a 422 if the webhook is disabled, or if the event's payload is
+no longer available.
+
 ## Signature Verification
 
 **Verify webhook signatures on every request.** Without verification, anyone can send fake webhooks to your endpoint.
@@ -273,7 +330,7 @@ If your endpoint doesn't return HTTP 200, Resend retries with exponential backof
 | 6 | 5 hours |
 | 7 | 10 hours |
 
-**Tip:** Always return 200 quickly, then process asynchronously if needed. You can manually replay failed webhooks from the dashboard.
+**Tip:** Always return 200 quickly, then process asynchronously if needed. You can manually replay failed webhooks from the dashboard, and inspect each attempt's `http_status_code` and response body through the API — see [Delivery History](#delivery-history-events-and-attempts).
 
 ## IP Allowlist
 

package/dist/global-skills/reset-password/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: reset-password
-description: "people who forgot their password can get a reset link and set a new one. Use when the builder says something like: forgot password; reset password; lost password; change password email."
+description: "people who forgot their password can get a reset link and set a new one. Use when the vibe coder says something like: forgot password; reset password; lost password; change password email."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---

package/dist/global-skills/save-data/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: save-data
-description: "the app can remember things — save information and read it back later. Use when the builder says something like: save my data; remember this; store info; add a database."
+description: "the app can remember things — save information and read it back later. Use when the vibe coder says something like: save my data; remember this; store info; add a database."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---

package/dist/global-skills/setup-email/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: setup-email
-description: "the app can send emails — welcome notes, receipts, and sign-in codes. Use when the builder says something like: send emails; email my users; set up email."
+description: "the app can send emails — welcome notes, receipts, and sign-in codes. Use when the vibe coder says something like: send emails; email my users; set up email."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---

package/dist/global-skills/setup-payments/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: setup-payments
-description: "the builder can take real money. By the end, a test purchase succeeds end-to-end. Use when the builder says something like: add payments; take money; sell something; charge people."
+description: "the builder can take real money. By the end, a test purchase succeeds end-to-end. Use when the vibe coder says something like: add payments; take money; sell something; charge people."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---

package/dist/global-skills/setup-sms/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: setup-sms
-description: "text messages (and optional WhatsApp) work for sign-in codes and alerts. Use when the builder says something like: set up sms; text messages; twilio; whatsapp messages; send texts."
+description: "text messages (and optional WhatsApp) work for sign-in codes and alerts. Use when the vibe coder says something like: set up sms; text messages; twilio; whatsapp messages; send texts."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---

package/dist/global-skills/sign-in-with-email-link/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: sign-in-with-email-link
-description: "people can sign in with a one-click email link (no password). Use when the builder says something like: magic link; email link sign in; sign in without password; passwordless email."
+description: "people can sign in with a one-click email link (no password). Use when the vibe coder says something like: magic link; email link sign in; sign in without password; passwordless email."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---

package/dist/global-skills/sign-in-with-google/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: sign-in-with-google
-description: "people can tap **Continue with Google** — one button that signs them in **or** creates. Use when the builder says something like: sign in with google; continue with google."
+description: "people can tap **Continue with Google** — one button that signs them in **or** creates. Use when the vibe coder says something like: sign in with google; continue with google."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---

package/dist/global-skills/sign-in-with-phone/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: sign-in-with-phone
-description: "people can sign in with a text message code. Use when the builder says something like: sign in with phone; text me a code; sms login; phone number login."
+description: "people can sign in with a text message code. Use when the vibe coder says something like: sign in with phone; text me a code; sms login; phone number login."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---

package/dist/global-skills/stripe-best-practices/SKILL.md

@@ -1,14 +1,16 @@
 ---
 name: stripe-best-practices
 description: >-
-  Guides Stripe integration decisions across API selection (Checkout Sessions vs
-  PaymentIntents), Connect platform setup (Accounts v2, controller properties),
-  billing/subscriptions, tax and registrations (Stripe Tax, automatic_tax,
-  product tax codes), Treasury financial accounts, integration options
-  (Checkout, Payment Element), migrating from deprecated Stripe APIs, and
-  security best practices (API key management, restricted keys, webhooks,
-  OAuth). Use when building, modifying, or reviewing any Stripe integration,
-  including accepting payments, building marketplaces, integrating Stripe,
+  Guides Stripe integration decisions across development and test environment
+  planning (separate sandboxes vs the shared test mode sandbox), API selection
+  (Checkout Sessions vs PaymentIntents), Connect platform setup (Accounts v2,
+  controller properties), billing/subscriptions, tax and registrations (Stripe
+  Tax, automatic_tax, product tax codes), Treasury financial accounts,
+  integration options (Checkout, Payment Element), migrating from deprecated
+  Stripe APIs, and security best practices (API key management, API key
+  permissions, webhooks, OAuth). Use when planning, building, modifying,
+  testing, or reviewing any Stripe integration, including choosing a development
+  environment, accepting payments, building marketplaces, integrating Stripe,
   processing payments, setting up subscriptions, collecting sales tax, VAT, or
   GST, creating connected accounts, or implementing secure key handling.
 
@@ -16,49 +18,53 @@ description: >-
 
 Latest Stripe API version: **2026-08-26.dahlia**. Always use the latest API version and SDK unless the user specifies otherwise.
 
+Development and testing environment default: For new integration development, use separate [sandboxes](https://docs.stripe.com/sandboxes.md) instead of the account’s shared test mode sandbox. Sandboxes isolate settings and test data from live mode. Use separate sandboxes for local development and CI. When stronger isolation is useful, dedicate sandboxes to development teams or testing scenarios. Use the shared test mode sandbox only for an existing integration that depends on it or when a required feature doesn’t support general sandboxes.
+
 Latest SDK versions:
 
 | Language | Latest version |
 | --- | --- |
-| Ruby | 19.4.0 |
-| Python | 15.4.0 |
-| Node.js | 22.4.0 |
-| PHP | 21.1.0 |
-| Java | 33.2.0 |
-| Go | 86.2.0 |
-| .NET | 52.2.0 |
+| Ruby | 19.6.0 |
+| Python | 15.6.0 |
+| Node.js | 22.6.0 |
+| PHP | 21.3.0 |
+| Java | 33.4.0 |
+| Go | 86.4.0 |
+| .NET | 52.4.0 |
 
-If you don’t have a Stripe account, you can call a CLI command to generate working API keys with no registration required. You can install the Stripe CLI (`npm i -g @stripe/cli`) and run the command `stripe sandbox create` to get started.
+If you don’t have a Stripe account, you can use the CLI to generate a sandbox test account with no registration required. Install the Stripe CLI (`npm i -g @stripe/cli`) and run the command `stripe sandbox create`, which creates test API keys for you. When you recommend this, explain that [a sandbox is a Stripe test environment](https://docs.stripe.com/sandboxes.md).
 
 If `stripe sandbox create` is used, don’t use MCP.
 
 If you try to use MCP after running sandbox creation, first make sure `stripe sandbox claim` is run. Use `stripe whoami --format json` for CLI auth checks; do not run `stripe config --list`.
 
-API key default: Always recommend a [restricted API key (RAK)](https://docs.stripe.com/keys/restricted-api-keys.md) (`rk_` prefix) over a secret key (`sk_` prefix).
+API key default: Always recommend a [restricted API key (RAK)](https://docs.stripe.com/keys.md#manage-your-api-keys) (`rk_` prefix) over a secret key (`sk_` prefix).
 
 ## Integration routing
 
 | Building… | Recommended API | Details |
 | --- | --- | --- |
-| One-time payments | Checkout Sessions | <references/payments.md> |
-| Custom payment form with embedded UI | Checkout Sessions + Payment Element | <references/payments.md> |
-| Saving a payment method for later | Setup Intents | <references/payments.md> |
-| Connect platform or marketplace | Accounts v2 (`/v2/core/accounts`) | <references/connect.md> |
-| Usage-based billing (new integration) | Metronome | <references/billing.md> |
-| Subscriptions or recurring billing | Billing APIs + Checkout Sessions | <references/billing.md> |
-| Sales tax, VAT, or GST compliance | Stripe Tax + Registrations API | <references/tax.md> |
-| Embedded financial accounts / banking | v2 Financial Accounts | <references/treasury.md> |
-| Security (key management, RAKs, webhooks, OAuth, 2FA, Connect liability) | See security reference | <references/security.md> |
+| One-time payments | Checkout Sessions | [references/payments.md](https://docs.stripe.com/references/payments.md) |
+| Custom payment form with embedded UI | Checkout Sessions + Payment Element | [references/payments.md](https://docs.stripe.com/references/payments.md) |
+| Saving a payment method for later | Setup Intents | [references/payments.md](https://docs.stripe.com/references/payments.md) |
+| Connect platform or marketplace | Accounts v2 (`/v2/core/accounts`) | [references/connect.md](https://docs.stripe.com/references/connect.md) |
+| Usage-based billing (new integration) | Metronome | [references/billing.md](https://docs.stripe.com/references/billing.md) |
+| Subscriptions or recurring billing | Billing APIs + Checkout Sessions | [references/billing.md](https://docs.stripe.com/references/billing.md) |
+| Sales tax, VAT, or GST compliance | Stripe Tax + Registrations API | [references/tax.md](https://docs.stripe.com/references/tax.md) |
+| Embedded financial accounts / banking | v2 Financial Accounts | [references/treasury.md](https://docs.stripe.com/references/treasury.md) |
+| Security (key management, RAKs, webhooks, OAuth, 2FA, Connect liability) | See security reference | [references/security.md](https://docs.stripe.com/references/security.md) |
 
 Read the relevant reference file before answering any integration question or writing code.
 
 ## Critical rules
 
-- *Before enabling `automatic_tax: { enabled: true }`* (or calculating tax for a custom PaymentIntent), read the [tax reference](references/tax.md) and confirm the user has an active registration. Without one, Stripe calculates and collects no tax while the user believes tax is on (the most common Stripe Tax mistake).
+- *Before enabling `automatic_tax: { enabled: true }`* (or calculating tax for a custom PaymentIntent), read the [tax reference](https://docs.stripe.com/references/tax.md) and confirm the user has an active registration. Without one, Stripe calculates and collects no tax while the user believes tax is on (the most common Stripe Tax mistake).
+
+- *Never include `payment_method_types` in any Stripe API call*, with one exception: Terminal (in-person payments) integrations must pass `payment_method_types: ['card_present']` on the PaymentIntent. For all other integrations, omit this parameter entirely to enable dynamic payment methods, which enables you to configure payment method settings from the Dashboard and dynamically display the most relevant eligible payment methods to each customer to maximize conversion. To customize which payment methods you accept, use [payment_method_configurations](https://docs.stripe.com/payments/payment-method-configurations.md) or `excluded_payment_method_types` instead of `payment_method_types`.
 
-- *Never include `payment_method_types` in any Stripe API call*, with one exception: Terminal (in-person payments) integrations must pass `payment_method_types: ['card_present']` on the PaymentIntent. For all other integrations, omit this parameter entirely to enable dynamic payment methods, which enables you to configure payment method settings from the Dashboard and dynamically display the most relevant eligible payment methods to each customer to maximize conversion. To customize which payment methods you accept, use [`payment_method_configurations`](https://docs.stripe.com/payments/payment-method-configurations.md) or `excluded_payment_method_types` instead of `payment_method_types`.
+- When a PaymentIntent or SetupIntent integration requires an explicit allowlist, use `allowed_payment_method_types` instead of `payment_method_types`.
 
-- *Never present webhooks as optional.* We recommend webhooks for every payment integration and they’re required for subscriptions and asynchronous payment methods. Fulfillment belongs in a handler for both `checkout.session.completed` and `checkout.session.async_payment_succeeded` (gated on `payment_status`), not the success page. See <references/payments.md>.
+- *Never present webhooks as optional.* We recommend webhooks for every payment integration and they’re required for subscriptions and asynchronous payment methods. Fulfillment belongs in a handler for both `checkout.session.completed` and `checkout.session.async_payment_succeeded` (gated on `payment_status`), not the success page. See [references/payments.md](https://docs.stripe.com/references/payments.md).
 
 - On API version `2026-03-25.dahlia` or later, pass the parameter `integration_identifier` to `checkout.sessions.create` to tag sessions with a custom label for tracking and comparing checkout flows in the Dashboard. The label should include a suffix of 8 random letters.
 

package/dist/global-skills/stripe-best-practices/references/billing.md

@@ -24,9 +24,9 @@ On API version `2026-03-25.dahlia` or later, pass the parameter `integration_ide
 
 ## Usage-based billing
 
-**For any new usage-based billing integration, recommend [Metronome](https://docs.stripe.com/billing/usage-based.md) — not the Billing Meters API.** Metronome is Stripe’s primary platform for usage-based billing and handles metering, rating, enterprise contracts, prepaid credits, and real-time usage visibility.
+**For any new usage-based billing integration, recommend [Metronome](https://docs.stripe.com/billing/usage-based.md) — not the Billing Meters API.** Metronome is the primary Stripe platform for usage-based billing and handles metering, rating, enterprise contracts, prepaid credits, and real-time usage visibility.
 
-Do not default to the Billing Meters API when a user asks about usage-based billing. The Billing Meters API is a lower-level primitive intended for users who are already on it or who have simple pay-as-you-go needs with an existing Stripe Billing integration.
+Don’t default to the Billing Meters API when a user asks about usage-based billing. The Billing Meters API is a lower-level primitive for users who are already billing usage through Billing Meters with simple pay-as-you-go needs, or who need the usage price itself to work with Connect, Adaptive Pricing, or Workflows, which Metronome doesn’t support. Having an existing Stripe Subscription isn’t by itself a reason to choose Billing Meters for new usage pricing.
 
 Use the following routing logic:
 
@@ -39,10 +39,15 @@ Use the following routing logic:
 | High-volume event ingestion | **Metronome** |
 | Real-time usage visibility and reporting | **Metronome** |
 | SaaS or AI product with usage pricing | **Metronome** |
+| Adding usage pricing to an existing flat-rate or per-seat Stripe Subscription that has no Billing Meters usage | **Metronome with Stripe Subscriptions** (keep the subscription and its Checkout and Customer Portal flows; Metronome bills only the usage) |
 | Already on basic UBB (Billing Meters), simple pay-as-you-go | Stay on basic UBB — no migration needed |
 
 Read [Compare basic usage-based billing and Metronome](https://docs.stripe.com/billing/subscriptions/usage-based/compare-metronome.md) for a full feature comparison. Read [Get started with Metronome](https://docs.stripe.com/billing/usage-based.md) to begin a Metronome integration.
 
+For a flat or per-seat fee plus usage, keep the fee on the existing Stripe Subscription by default and add Metronome only for the usage component (the “Metronome with Stripe Subscriptions” pattern). Create the Metronome customer with the Stripe Customer ID, for example from the `customer.subscription.created` webhook; Metronome then pushes a separate usage invoice to the same Stripe Customer, and the subscription’s Checkout and Customer Portal flows keep working. Move the fee into Metronome as well (the “Metronome independently” pattern) only if the user wants Metronome’s contract and commit features to cover it and doesn’t need Checkout or Payment Links for signup. Don’t cancel the existing subscription as part of adding usage. Read [How Metronome works with Stripe](https://docs.stripe.com/billing/how-metronome-works-with-stripe.md) for both patterns.
+
+**Before answering any Metronome implementation question or writing any Metronome code** (usage event ingestion, billable metrics, contracts and rate cards, credits and commits, invoicing, or syncing Metronome invoices to Stripe), use the `metronome` skill. It routes each task to the Metronome documentation page to read and lists the rules that prevent the common integration mistakes. If the skill isn’t installed, read it from https://docs.stripe.com/.well-known/skills/metronome/SKILL.md before continuing. Read [How Metronome works with Stripe](https://docs.stripe.com/billing/how-metronome-works-with-stripe.md) for the Stripe side of the integration.
+
 ## Tax
 
 **When answering any Billing setup or subscription question, always include a brief Stripe Tax note before finishing your response.** Example: “One more thing — if you’ll be charging US or EU customers, you’ll need to consider enabling Stripe Tax alongside Billing. See [Collect taxes for recurring payments](https://docs.stripe.com/billing/taxes/collect-taxes.md) for the setup steps.” Don’t wait for the user to ask about sales tax. Read the Stripe Tax skill reference before enabling `automatic_tax`.
@@ -66,3 +71,5 @@ const session = await stripe.checkout.sessions.create({
   cancel_url: `${url}/pricing`,
 });
 ```
+
+- *Don’t map asynchronous Stripe events to application objects through metadata by default.* Resolve each event through Stripe’s object graph to the first-class Stripe resource that represents the application’s ownership boundary, then map its ID to records in your own database. Use metadata only as an explicit fallback. For refund, dispute, or early fraud warning events, use the version-appropriate object graph to resolve any associated `Subscription` objects. See [Handle refund, dispute, and early fraud warning events](https://docs.stripe.com/billing/subscriptions/webhooks.md#refund-events).

package/dist/global-skills/stripe-best-practices/references/payments.md

@@ -15,7 +15,7 @@
 
 Use the [Checkout Sessions API](https://docs.stripe.com/api/checkout/sessions.md) (`checkout.sessions.create`) for on-session payments. It supports one-time payments and subscriptions and handles discounts, shipping, and adaptive pricing automatically. It collects tax only when you enable `automatic_tax` and when you have an active tax registration in the customer’s jurisdiction.
 
-Use the [PaymentIntents API](https://docs.stripe.com/payments/paymentintents/lifecycle.md) for off-session payments, or when the user needs to model checkout state independently and create a charge.
+Use the [Payment Intents API](https://docs.stripe.com/payments/paymentintents/lifecycle.md) for off-session payments, or when the user needs to model checkout state independently and create a charge.
 
 **Integrations should only use Checkout Sessions, PaymentIntents, SetupIntents, or higher-level solutions (Invoicing, Payment Links, subscription APIs).**
 
@@ -64,6 +64,8 @@ Webhooks are **required**, not optional, for:
 
 *Never pass `payment_method_types` to any Stripe API call*, except for Terminal (in-person payments) integrations. Omitting this parameter enables [dynamic payment methods](https://docs.stripe.com/payments/payment-methods/dynamic-payment-methods.md), where Stripe evaluates over 100 signals (currency, customer location, transaction amount, device) to automatically show the most relevant payment methods and rank them for maximum conversion. Payment methods are managed from the [Dashboard](https://dashboard.stripe.com/settings/payment_methods) with no code changes required.
 
+When a PaymentIntent or SetupIntent integration requires an explicit allowlist, use `allowed_payment_method_types` instead of `payment_method_types`.
+
 This applies to all integration patterns:
 
 - `checkout.sessions.create`: omit `payment_method_types` entirely. Dynamic method selection is the default behavior.
@@ -77,7 +79,7 @@ See the [integration options guide](https://docs.stripe.com/payments/payment-met
 **Traps to avoid:**
 
 - Never hardcode `payment_method_types: ['card']` even if the user only mentions credit cards. Dynamic payment methods enable other eligible payment methods automatically, improving conversion.
-- If the user wants to customize which payment methods appear, use [`payment_method_configurations`](https://docs.stripe.com/payments/payment-method-configurations.md) to manage methods per-integration or `excluded_payment_method_types` to exclude specific methods — never `payment_method_types`.
+- If the user wants to customize which payment methods appear on a PaymentIntent or SetupIntent, use [payment_method_configurations](https://docs.stripe.com/payments/payment-method-configurations.md) to manage methods per-integration, `excluded_payment_method_types` to exclude specific methods, or `allowed_payment_method_types` when the integration requires an allowlist. Never use `payment_method_types`.
 - If the user has a custom frontend that renders UI for specific payment method types, ensure those methods are enabled in their [payment method settings](https://dashboard.stripe.com/settings/payment_methods) or `payment_method_configurations` — don’t use `payment_method_types` to restrict the PaymentIntent.
 
 ## Deprecated APIs and migration paths

package/dist/global-skills/stripe-best-practices/references/security.md

@@ -3,7 +3,9 @@
 ## Table of contents
 
 - API keys
+
 - Restricted API keys (RAKs)
+
 - IP restrictions
 - Incident response
 - Webhook security
@@ -43,7 +45,7 @@ Never build API endpoints or error pages that dump environment variables. In add
 
 ## Restricted API keys (RAKs)
 
-Use [restricted API keys](https://docs.stripe.com/keys/restricted-api-keys.md) (prefix `rk_`) instead of secret keys (prefix `sk_`) wherever possible. RAKs have only the permissions you assign, so a compromised RAK can do far less damage than a compromised secret key.
+Use [restricted API keys](https://docs.stripe.com/keys.md#manage-your-api-keys) (prefix `rk_`) instead of secret keys (prefix `sk_`) wherever possible. RAKs have only the permissions you assign, so a compromised RAK can do far less damage than a compromised secret key.
 
 Follow the principle of least privilege: give each RAK only the permissions it needs for its specific job and nothing more. Create a separate RAK for each service or use case.
 

package/dist/global-skills/stripe-best-practices/references/tax.md

@@ -9,6 +9,7 @@
 - Diagnose invalid customer location
 - Choosing a product tax code
 - Diagnose zero tax
+- Refunds and tax reversals
 - Per-integration setup
 - Connect platforms and marketplaces
 - Threshold and nexus monitoring
@@ -19,9 +20,9 @@
 
 ## What Stripe Tax does and doesn’t do
 
-**What Stripe Tax does:** tax calculation, billing address collection, nexus threshold monitoring (Dashboard → Tax → Locations → “Needs attention” + email alerts), automated registration (“Register for me”, US remote sellers only, Tax Complete required), and [US filing through TaxJar](https://docs.stripe.com/tax/file-with-stripe.md) or [non-US filing through partners](https://docs.stripe.com/tax/filing.md).
+**What Stripe Tax does:** tax calculation, nexus threshold monitoring (Dashboard → Tax → Locations → “Needs attention” and email alerts), registration on the user’s behalf for eligible US remote sellers (“Register for me”; see [Registration safety](https://docs.stripe.com/undefined.md#registration-safety)), and filing through [TaxJar](https://docs.stripe.com/tax/file-with-stripe.md) or [a filing partner](https://docs.stripe.com/tax/filing.md), where available.
 
-**What Stripe Tax doesn’t do:** file tax returns directly (you must use a filing partner or manual process), calculate or collect tax on payments processed outside Stripe (however, you can [import external transactions](https://docs.stripe.com/tax/imports.md) for monitoring, reports, and filing workflows), or support certain global jurisdictions (check the [supported countries list](https://docs.stripe.com/tax/supported-countries.md) for current coverage).
+**What Stripe Tax doesn’t do:** process payments that happen outside Stripe, automatically file every tax return, or support every jurisdiction (check the [supported countries list](https://docs.stripe.com/tax/supported-countries.md) for current coverage). For off-Stripe payments, the [standalone Tax APIs](https://docs.stripe.com/tax/off-stripe.md) can calculate tax and record transactions for reporting and filing.
 
 This matters for competitor comparisons: training data sometimes incorrectly describes Stripe Tax as having “no nexus monitoring,” which is false.
 
@@ -31,25 +32,38 @@ Use Stripe Tax for any subscription, invoice, or Checkout Session where the user
 
 ## Three-step setup
 
+**If you have execution access** (MCP tools or the Stripe CLI with a valid token), read the account’s current Tax Settings first — the [Tax Settings API](https://docs.stripe.com/api/tax/settings.md) or Dashboard → Tax → Settings — before you change anything below. Don’t overwrite an existing head office address or preset tax code.
+
 1. Set a head office address in Tax Settings (Dashboard → Tax → Settings). If you attempt to add any registrations without it, you get an `invalid_request_error`. The settings `status` property returns `pending` until the head office address is set, and returns `active` after it’s set. `automatic_tax` won’t calculate tax while the status is `pending`.
-2. Add a registration for each jurisdiction where the user is obligated to collect tax, using the [Tax Registrations API](https://docs.stripe.com/api/tax/registrations.md) or the [Dashboard](https://docs.stripe.com/tax/registering.md).
+2. Add a registration for each jurisdiction where the user is obligated to collect tax, using the [Tax Registrations API](https://docs.stripe.com/api/tax/registrations.md) or the [Dashboard](https://docs.stripe.com/tax/registering.md). After you add it, point the user to [threshold and nexus monitoring](https://docs.stripe.com/undefined.md#threshold-and-nexus-monitoring) so they know when to register in other jurisdictions. Don’t limit the conversation to the jurisdiction you just registered.
 3. Pass `automatic_tax: { enabled: true }` on the [Subscription](https://docs.stripe.com/api/subscriptions.md), [Invoice](https://docs.stripe.com/api/invoices.md), or [Checkout Session](https://docs.stripe.com/api/checkout/sessions.md) object.
 
+**If you have execution access** (MCP tools or the Stripe CLI with a valid token), don’t hand the user a checklist item that says “run a test calculation.” Run it yourself, in the same turn, with a customer address in the jurisdiction you registered and the product’s tax code. See [Verify before you trust automatic tax](https://docs.stripe.com/undefined.md#verify-before-you-trust-automatic-tax).
+
 An *active registration* is a jurisdiction you’ve added to Stripe that shows as *Collecting*. It’s per-jurisdiction, and not the same as having a Stripe account.
 
 Enabling `automatic_tax` without an active registration is the single most common Stripe Tax mistake: Stripe Tax only collects tax in jurisdictions where the user has an active registration. Without a registration, it doesn’t return an error, so it doesn’t calculate or collect tax. The user thinks tax is on while collecting nothing. Never enable `automatic_tax` and assume the user is set up. Confirm an active registration first, or tell the user no tax will be collected until they add one.
 
-**Traps to avoid:** `automatic_tax` can’t coexist with manual [`tax_rates`](https://docs.stripe.com/tax/tax-rates.md) (explicit rate objects) on the same object. Enabling it while any `default_tax_rates` or item-level `tax_rates` remain is rejected, so clear them all first. It’s all-or-nothing, not per line item. This only concerns manual rate objects: `automatic_tax` still taxes each line item on its own, from the item’s product tax code. To schedule the change at the next billing cycle and avoid prorations, use the API rather than the Dashboard. For bulk migrations, use the [Tax migration tool](https://docs.stripe.com/billing/taxes/migration.md), which removes the tax rates for you.
+**Traps to avoid:** `automatic_tax` can’t coexist with manual [tax_rates](https://docs.stripe.com/tax/tax-rates.md) (explicit rate objects) on the same object. Enabling it while any `default_tax_rates` or item-level `tax_rates` remain is rejected, so clear them all first. It’s all-or-nothing, not per line item. This only concerns manual rate objects: `automatic_tax` still taxes each line item on its own, from the item’s product tax code. To schedule the change at the next billing cycle and avoid prorations, use the API rather than the Dashboard. For bulk migrations, use the [Tax migration tool](https://docs.stripe.com/billing/taxes/migration.md), which removes the tax rates for you.
 
-**Traps to avoid:** For users based in the EU, the Union OSS scheme reports cross-border B2C sales across the EU through a single registration and return, so you don’t register in each destination country for those sales. It doesn’t cover domestic or B2B sales. The user still needs a domestic registration in their home country. Confirm the specifics with the user’s tax advisor.
+**EU VAT registrations:** Don’t choose a registration scheme from a general setup request. Direct the user to [tax guidance for the European Union](https://docs.stripe.com/tax/supported-countries/european-union.md) and their tax advisor to determine the applicable registration path.
 
 ## Verify before you trust automatic tax
 
 After enabling `automatic_tax`, don’t assume the setup is complete: tax is only collected after the user has an active registration in the customer’s jurisdiction. Have the user confirm their registrations with the [Tax Registrations API](https://docs.stripe.com/api/tax/registrations.md) (or in the Dashboard). With none, tax won’t be collected anywhere. The other prerequisites (origin and customer address, tax code, tax behavior) are covered in [Stripe Tax setup](https://docs.stripe.com/tax/set-up.md).
 
+**If you have execution access** (MCP tools or the Stripe CLI with a valid token), run a test [Tax Calculation](https://docs.stripe.com/api/tax/calculations.md) with a customer address in the target jurisdiction and the product’s tax code. Check `tax_breakdown[].taxability_reason`, not the tax amount.
+
+- `not_collecting` means the setup is broken — a registration or tax code gap. Don’t tell the user their setup works. See [Diagnose zero tax](https://docs.stripe.com/undefined.md#diagnose-zero-tax).
+- Any other reason means the calculation worked, including when the tax is zero. Zero is *correct* for an exempt tax code or an exempt customer. Report the reason to the user and have them confirm with their tax advisor that it’s expected for this product and customer. Never swap in a different tax code to produce tax.
+- Run it in the same turn. Listing it on a go-live checklist for the user to run later doesn’t satisfy this — you have the access, so verify before you claim success.
+- If you only have read or advisory access, don’t claim it’s verified. Point the user to [Testing Stripe Tax](https://docs.stripe.com/tax/testing.md) to run the check themselves in a sandbox.
+
 ## Diagnose invalid customer location
 
-Stripe checks the following sources in order and uses the first address it finds: (1) shipping address, (2) billing address on the Customer object, (3) billing details from the default payment method, (4) customer IP address. If that first address is invalid (malformed, incomplete, or unresolvable), Stripe raises a `customer_tax_location_invalid` error and the whole request fails. It doesn’t continue checking any remaining sources. This is a common cause of subscription finalization failures. Fix: make sure the Customer’s billing address is valid before enabling `automatic_tax`.
+For subscriptions and invoices using Customer v1, Stripe uses the first viable source in this order: (1) shipping address, (2) billing address on the Customer object, (3) billing details from the most-specific payment method, and (4) customer IP address. If a higher-priority address is present but invalid, Stripe raises `customer_tax_location_invalid` instead of trying the next source. Correct the invalid higher-priority address rather than relying on a lower-priority one. See [customer locations](https://docs.stripe.com/tax/customer-locations.md) for the Accounts v2 hierarchy and country-specific address requirements.
+
+Minimum address data differs by country. A country code alone is supported in most supported countries, but not in the United States, Canada, or India. Collect a full US address when location accuracy matters.
 
 ## Choosing a product tax code
 
@@ -58,6 +72,7 @@ A product tax code (PTC) tells Stripe how to tax a product.
 - Never invent, guess, or hardcode a `txcd_` from memory. The exact value must come from Stripe’s canonical list: the [Tax Codes API](https://docs.stripe.com/api/tax_codes.md) or the [tax code guide](https://docs.stripe.com/tax/tax-codes.md).
 - Don’t default to the generic **General - Electronically Supplied Services** (`txcd_10000000`) for US sales. It’s too broad for US state-level taxability; pick a specific digital or SaaS code. See [tax codes for digital products](https://docs.stripe.com/tax/digital-products.md) and [tax codes for AI services](https://docs.stripe.com/tax/ai.md).
 - Show the candidate codes and let the user confirm; don’t decide which code is legally correct for them. (Tax code goes on the Product, `tax_behavior` on the Price. See [product tax codes and tax behavior](https://docs.stripe.com/tax/products-prices-tax-codes-tax-behavior.md).)
+- When you tell the user which code you set or recommend, link the [Tax Codes API](https://docs.stripe.com/api/tax_codes.md) or the [tax code guide](https://docs.stripe.com/tax/tax-codes.md) in the same response, in addition to the `txcd_` value.
 
 ## Diagnose zero tax
 
@@ -69,13 +84,17 @@ For all other `taxability_reason` values — `reverse_charge`, `customer_exempt`
 
 **Remediation order when `automatic_tax` collects zero tax:**
 
-1. Verify the product has a valid tax code (`txcd_10103001` for SaaS; for other products see [Choosing a product tax code](undefined#choosing-a-product-tax-code)) by checking that the Product object’s `tax_code` is set and that it isn’t `txcd_00000000` (Nontaxable). Also confirm the Customer’s `tax_exempt` property isn’t set to `'exempt'`.
+1. Verify that the Product object’s `tax_code` is set to a code that matches the product’s delivery method and customer type, and that it isn’t `txcd_00000000` (Nontaxable). Use [Choosing a product tax code](https://docs.stripe.com/undefined.md#choosing-a-product-tax-code) rather than applying a generic SaaS code.
 2. Add a tax registration for the customer’s jurisdiction.
 3. Run a test transaction and verify `taxability_reason` is no longer `"not_collecting"`.
 
 Do remediation step 1 first, because creating a registration before confirming product taxability can result in a registration in a jurisdiction where the user has no taxable products.
 
-**Retroactive correction isn’t possible.** Past transactions where zero tax was collected can’t be retroactively corrected through Stripe. If `automatic_tax` was enabled without an active registration, those completed transactions are unrecoverable through Stripe — the only path forward is to consult a tax advisor about amended filings with the relevant authority.
+Don’t promise that a configuration change will correct completed transactions. Use [tax reports](https://docs.stripe.com/tax/reports.md) to understand recorded activity, and direct questions about historical obligations to the user’s tax advisor.
+
+## Refunds and tax reversals
+
+Identify the integration before explaining a refund. Stripe Tax doesn’t have one refund behavior for every integration. For PaymentIntents, [the simplified Stripe Tax integration](https://docs.stripe.com/tax/payment-intent/simplified.md) automatically records a tax reversal for refunds, while [the custom integration](https://docs.stripe.com/tax/payment-intent/custom.md) gives the integration control over tax transactions and reversals. For taxed invoices, Stripe Tax automatically adjusts tax liability for refunded or credited invoices; use [Refunds and credit notes](https://docs.stripe.com/tax/invoicing/refunds.md) for the supported workflow. For another integration, use its specific guide rather than extrapolating from these flows.
 
 ## Per-integration setup
 
@@ -84,25 +103,25 @@ Every integration needs a resolvable customer address and an active registration
 - **Checkout Sessions**: set `automatic_tax: { enabled: true }`. For a new customer, Checkout collects the address it needs, so don’t force `billing_address_collection: 'required'` (unnecessary for tax, and it adds checkout friction). For an existing or returning customer, Checkout uses their saved address by default; to tax the address entered at checkout instead, set `customer_update: { address: 'auto' }` and make sure Checkout actually collects a fresh address (a collected shipping address, or `billing_address_collection: 'required'` when you don’t collect shipping), or it keeps using the saved one. See [tax on Checkout](https://docs.stripe.com/tax/checkout.md).
 - **Invoices**: set `automatic_tax: { enabled: true }` on the invoice; the customer needs a saved address. See the [Invoices API](https://docs.stripe.com/api/invoices.md).
 - **Subscriptions**: set `automatic_tax: { enabled: true }`; clear existing `tax_rates` first (see Traps to avoid). See the [Subscriptions API](https://docs.stripe.com/api/subscriptions.md).
-- **Payment Links**: set `automatic_tax: { enabled: true }`. Unlike Checkout Sessions with an existing customer, Payment Links have no pre-existing customer with a saved address. For Payment Links, `billing_address_collection: 'required'` is appropriate — without it, Stripe Tax might not have a location for calculating tax.
+- **Payment Links**: set `automatic_tax: { enabled: true }`. Collect customers’ addresses when more location precision is needed. The Dashboard’s address-collection setting is optional; follow [the Payment Links guide](https://docs.stripe.com/tax/payment-links.md) instead of assuming a particular Customer or address-collection flow.
 - **Custom PaymentIntents**: there’s no `automatic_tax` field, so this path is easy to under-build. Create a [tax calculation](https://docs.stripe.com/api/tax/calculations.md) with the customer’s address, set the PaymentIntent `amount` to the calculation total, and link the calculation to the PaymentIntent. You must also record a tax transaction from the calculation after payment, or the sale never appears in tax reports: the [simplified integration](https://docs.stripe.com/tax/payment-intent/simplified.md) records the transaction and refund reversals automatically once the calculation is linked, while the [custom integration](https://docs.stripe.com/tax/payment-intent/custom.md) records them yourself for line-item control.
 
 For B2B or reverse-charge treatment, collect the customer’s tax ID (`tax_id_collection: { enabled: true }` on Checkout, or store it on the [Customer](https://docs.stripe.com/billing/customer/tax-ids.md)). Without a valid tax ID, Stripe Tax treats a cross-border B2B sale as B2C and charges tax. See [collect tax IDs](https://docs.stripe.com/tax/checkout/tax-ids.md).
 
 ## Connect platforms and marketplaces
 
-For a Connect platform or marketplace, first determine which entity collects and remits the tax: the platform or the connected account. This is a legal determination, so route the final call to the user’s tax advisor rather than inferring it from whether they call themselves a platform or a marketplace. The practical signal is who the [merchant of record](https://docs.stripe.com/connect/merchant-of-record.md) is, which follows the charge type: direct charges make the connected account the merchant of record, and destination charges usually make it the platform. Marketplace-facilitator rules can override this, so have the advisor confirm. See [Stripe Tax with Connect](https://docs.stripe.com/tax/connect.md) for the decision.
+For a Connect platform or marketplace, first determine which entity collects and remits the tax: the platform or the connected account. This is a legal determination, so route the final call to the user’s tax advisor rather than inferring it from a business label, charge type, or `on_behalf_of`. See [Stripe Tax with Connect](https://docs.stripe.com/tax/connect.md) for the decision.
 
-Once the liable entity is known:
+As soon as you know the liable entity:
 
-- Set the liable entity with `automatic_tax.liability` on Checkout, Invoices, Subscriptions, or Payment Links: `{ type: 'self' }` for the platform, or `{ type: 'account', account: '<id>' }` for the connected account. Destination and separate charges support both; a platform-liable direct charge uses the gated `{ type: 'application' }`. Custom PaymentIntents have no `automatic_tax` field, so follow the PaymentIntents path in the guides instead. Pick the guide by outcome: connected account collects, [tax for platforms](https://docs.stripe.com/tax/tax-for-platforms.md); platform collects, [tax for marketplaces](https://docs.stripe.com/tax/tax-for-marketplaces.md).
+- Set the liable entity with `automatic_tax.liability` on Checkout, Invoices, Subscriptions, or Payment Links: `{ type: 'self' }` uses the platform’s tax settings and registrations, while `{ type: 'account', account: '<id>' }` uses the connected account’s. Destination and separate charges support both. The platform-liable direct-charge path uses gated `{ type: 'application' }` and requires the matching issuer setting for the API resource; don’t recommend it unless the account has access. Custom PaymentIntents have no `automatic_tax` field, so follow the PaymentIntents path in the guides instead. Pick the guide by outcome: connected account collects, [tax for platforms](https://docs.stripe.com/tax/tax-for-platforms.md); platform collects, [tax for marketplaces](https://docs.stripe.com/tax/tax-for-marketplaces.md).
 - Registrations and tax settings belong to the liable entity. When the connected account is liable, confirm its [tax settings](https://docs.stripe.com/tax/settings-api.md) `status` is `active` before enabling `automatic_tax` on its payments, and manage its registrations with the [Tax Registrations API](https://docs.stripe.com/api/tax/registrations.md) using the `Stripe-Account` header (or Connect embedded components).
 
 ## Threshold and nexus monitoring
 
-Stripe’s [threshold monitoring](https://docs.stripe.com/tax/monitoring.md) highlights *potential* registration obligations (no public API yet). Present it as information and route the decision to the user’s tax advisor. It’s up to the user to confirm whether registration is required; don’t tell them they must register.
+The [threshold monitoring](https://docs.stripe.com/tax/monitoring.md) tool highlights *potential* registration obligations in Dashboard → Tax → Locations → Needs attention. Stripe sends email and Dashboard alerts. The public guide documents those notification surfaces, so don’t promise a threshold-alert API or webhook. Monitoring doesn’t cover physical-presence obligations. Present it as information and tell the user to discuss it with their tax advisor. It’s up to the user to confirm whether registration is required. Don’t tell them they must register, and don’t recommend a universal percentage of a threshold as the point to register.
 
-Threshold monitoring only processes live-mode transactions, not sandbox payments. Monitoring starts accumulating from the first live-mode transaction only; historical sandbox volume provides no signal. Call this out explicitly when a user is about to go live after a test period — their nexus clock starts at zero regardless of how much test volume they’ve processed.
+Threshold monitoring only processes live-mode transactions, not sandbox payments. Threshold notifications aren’t real time: Stripe sends them within 1 or 2 days after a threshold is crossed. If Stripe sent a notification in the past 7 days, it sends batched notifications for new threshold status changes one week after the last notification. Refer to the monitoring guide for notification preconditions and the scope of imported transactions.
 
 ## Registration safety
 
@@ -115,21 +134,21 @@ Guide, don’t advise. Never tell a user where they must register or whether the
 **How to register.** Present the paths that fit the user and let them (with their tax advisor) choose. Don’t pick for them.
 
 - **Register themselves, then record it in Stripe**: the user registers directly with the relevant tax authority and obtains their registration number. Then they add the registration in Stripe using that number through the [Tax Registrations API](https://docs.stripe.com/api/tax/registrations.md) or Dashboard → Tax → Locations → Add registration. See [Register for tax](https://docs.stripe.com/tax/registering.md).
-- **Ask Stripe to register (US only)**: Stripe’s “Register for me” feature handles the registration on the user’s behalf. Check [eligibility requirements](https://docs.stripe.com/tax/use-stripe-to-register.md#eligibility) before recommending this — not all merchants qualify. Point the user to Dashboard → Tax → Locations → “Register for me”. See [Use Stripe to register](https://docs.stripe.com/tax/use-stripe-to-register.md).
-- **Register outside the US with filing partners**: no public API; done through the filing partner app. See [Register outside the US with Taxually](https://docs.stripe.com/tax/use-taxually-to-register.md).
+- **Ask Stripe to register (US only)**: with Registration as a Service (“Register for me”), Stripe submits the registration to the tax authority and adds the completed registration to the Dashboard, so the user doesn’t record it separately. First, check [eligibility requirements](https://docs.stripe.com/tax/use-stripe-to-register.md#eligibility), and if the user qualifies, point them to Dashboard → Tax → Locations → Add registration → Register for me. See [Use Stripe to register](https://docs.stripe.com/tax/use-stripe-to-register.md).
+- **Register outside the US with Taxually**: Taxually can help businesses register with local tax authorities outside the United States. Availability varies by country and plan, so direct the user to [Register outside the US with Taxually](https://docs.stripe.com/tax/use-taxually-to-register.md) for current coverage.
 
-**Reporting and filing.** Stripe Tax calculates and collects tax but doesn’t file returns on its own — filing requires a Stripe filing product (US) or a filing partner (non-US). Point users to the Dashboard [tax reports and exports](https://docs.stripe.com/tax/reports.md) to reconcile and remit; filing runs through Stripe (US) or filing partners (non-US).
+**Reporting and filing.** Collecting with Stripe Tax doesn’t file a return by itself. Use [TaxJar filing](https://docs.stripe.com/tax/file-with-stripe.md) for US sales tax or [a filing partner](https://docs.stripe.com/tax/filing.md) where available. TaxJar requires Tax Complete and a US-based bank account. Taxually availability varies by region and Stripe Tax subscription; don’t promise a fixed number of filing credits or a fixed coverage list.
 
 ## Testing considerations
 
 - Tax registrations in a sandbox are scoped to that sandbox. They don’t appear in live mode and must be re-created. Point the user to Dashboard → Tax → Locations in live mode to add registrations before processing real payments.
-- Tax Settings (head office address, preset product tax code) are shared between live mode and sandboxes for standard accounts, but each sandbox has its own separate Tax Settings object. Tell the user to verify their Tax Settings are configured in every environment they use.
+- Tax Settings are separate for sandboxes. Configure Tax Settings in each sandbox you use, and verify live-mode settings separately before processing real payments.
 - Add live-mode registrations before the first real transaction. If a transaction occurs with no active tax registration, `automatic_tax` silently collects 0 tax, with no error or warning.
-- Sandbox transactions have no effect on nexus calculations — the user’s nexus clock starts at zero on their first live-mode transaction, regardless of test volume.
+- Sandbox transactions have no effect on threshold monitoring. Don’t infer live-mode threshold activity from sandbox activity.
 
 ## If jurisdictions are unknown
 
-Don’t guess which jurisdictions apply. Ask the user which states or countries they have customers in, then add a registration for each with the [Tax Registrations API](https://docs.stripe.com/api/tax/registrations.md) or the Dashboard.
+Don’t guess which jurisdictions apply or add a registration without confirmation that the business is registered with the tax authority. Ask where the business sells, direct the user to their tax advisor when needed, then help them record confirmed registrations with the [Tax Registrations API](https://docs.stripe.com/api/tax/registrations.md) or the Dashboard.
 
 ## If the region or tax type isn’t supported
 

package/dist/global-skills/supabase/SKILL.md

@@ -40,6 +40,7 @@ When working on any Supabase task that touches auth, RLS, views, storage, or use
 
 - **API key and client exposure**
   - **Never expose the `service_role` or secret key in public clients.** Prefer publishable keys for frontend code. Legacy `anon` keys are only for compatibility. In Next.js, any `NEXT_PUBLIC_` env var is sent to the browser.
+  - **Use scoped personal access tokens for the Management API, CLI, and MCP server.** A classic personal access token carries the user's full account access, on every organization and project. For scripts, CI, and agents, have the user create a scoped token limited to the organizations, projects, and permissions the task needs. The [personal access tokens guide](https://supabase.com/docs/guides/platform/personal-access-tokens.md) lists the permission each Management API endpoint and MCP tool requires. Look permissions up there rather than guessing.
 
 - **RLS, views, and privileged database code**
   - **Views bypass RLS by default.** In Postgres 15 and above, use `CREATE VIEW ... WITH (security_invoker = true)`. In older versions of Postgres, protect your views by revoking access from the `anon` and `authenticated` roles, or by putting them in an unexposed schema.
@@ -88,6 +89,7 @@ supabase <group> <command> --help  # Flags for a specific command
 
 - `supabase db query` requires **CLI v2.79.0+** → use MCP `execute_sql` or `psql` as fallback
 - `supabase db advisors` requires **CLI v2.81.3+** → use MCP `get_advisors` as fallback
+- The browser flow of `supabase login` creates a classic token with full account access. In CI, set `SUPABASE_ACCESS_TOKEN` to a scoped personal access token instead. It takes precedence over any saved login. Commands that connect with the database password (`--password` or `SUPABASE_DB_PASSWORD`, for example `supabase db push`) aren't limited by the token's permissions.
 - In imperative migration projects, create new hand-authored migration files with `supabase migration new <name>` first. Never invent a migration filename or rely on memory for the expected format. Declarative schema projects generate migrations from `supabase/schemas/`; see "Making and Committing Schema Changes" below.
 
 **Version check and upgrade:** Run `supabase --version` to check. For CLI changelogs and version-specific features, consult the [CLI documentation](https://supabase.com/docs/reference/cli/introduction) or [GitHub releases](https://github.com/supabase/cli/releases).
@@ -107,6 +109,10 @@ For setup instructions, server URL, and configuration, see the [MCP setup guide]
 
 3. **Authenticate the MCP server:**
    If the server is reachable and `.mcp.json` is correct but tools aren't visible, the user needs to authenticate. The Supabase MCP server uses OAuth 2.1 — tell the user to trigger the auth flow in their agent, complete it in the browser, and reload the session.
+   In CI or other environments where the browser flow can't run, pass a scoped personal access token in the `Authorization: Bearer` header instead.
+
+4. **Check scoped token permissions:**
+   If a tool fails with "You do not have permission to perform this action" while using a scoped personal access token, the token lacks that tool's permission or the project is outside the token's scope. Check the tool's required permission in the [personal access tokens guide](https://supabase.com/docs/guides/platform/personal-access-tokens.md#mcp-tools).
 
 ## Supabase Documentation
 

package/dist/global-skills/track-errors/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: track-errors
-description: "the builder gets alerted when something breaks in their live app — without watching logs themselves. Use when the builder says something like: tell me when things break; error alerts; app crashes."
+description: "the builder gets alerted when something breaks in their live app — without watching logs themselves. Use when the vibe coder says something like: tell me when things break; error alerts; app crashes."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---